Secured data input device

ABSTRACT

The invention relates to the making safe of a device for inputting data to an item of equipment. The invention is of particular use in the aeronautical field, for example in order to validate data relating to flight conditions. 
     The invention proposes data validation means, of nature different from that of the data input means themselves. 
     For this purpose, the device comprises means ( 5 ) for detecting the presence of an operator inputting data and validation means ( 9 ) making it possible to take account of the data only if a contact with the operator is detected.

The invention relates to a device for inputting data to an item ofequipment, for example electronic equipment. The device comprises amobile member intended to be moved by an operator. The entered databeing a function of the movement of the mobile member. The mobile membercan, for example, be formed by a key of a keyboard, a rotary knob or atrack ball.

Certain data is very sensitive and therefore requires safe data input.By way of example, in the aeronautical field, the data relating toflight conditions, like the altitude or vertical speed commands, is verysensitive. Instabilities in the input of this data, due for example tovibrations, can result in involuntary modifications of the data, whichcan be very prejudicial to the control of an aircraft.

An input of data can be validated by a double movement of the mobilemember. For example, the input of data carried out with the use of arotary knob can be made safe by the pushing in of this knob. This doublemovement is complicated to use and sometimes impossible when, forexample, all of the possible movements of a mobile member are used forinputting data.

The purpose of the invention is to simplify the making safe of a datainput device by proposing means for validating input data, means havinga nature different from that of the input means themselves.

For this purpose, the invention relates to a device for inputting datato an item of equipment comprising a mobile member intended to be movedby an operator, the input data being dependent on the movement of themobile member, characterized in that the device furthermore comprises:

-   -   detection means providing information representing the existence        or non-existence of a contact between the operator and the        mobile member,    -   validation means receiving said information and said input data,

and in that the validation means supply said input data to the equipmentonly when the information represents the existence of a contact betweenthe operator and the mobile member.

The data input is in this case a mechanical movement of the mobilemember. The validation of input data uses information which is not amovement but a simple contact between the operator and the mobilemember. The fact that the actions necessary for data input andvalidation are of different nature, on the one hand a mechanicalmovement and on the other had a contact, makes it possible to make thedata input safe. In fact, if the actions were of the same nature, forexample two movements, a single external interference, such as forexample a vibration, would be capable of inputting an erroneous item ofdata and of validating it.

Advantageously, the contact with the operator, detected by the detectionmeans, is the normal contact the operator makes in order to move themobile member. Thus it is not necessary for the operator to carry out amechanical action other than the one necessary for the movement of themobile member.

The invention will be better understood and other advantages will becomeapparent on reading the detailed description of several embodiments ofthe invention, this description being illustrated by the appendeddrawing in which:

FIG. 1 is a diagrammatic representation of the means of the invention;

FIG. 2 shows a rotary knob;

FIG. 3 shows a push-button;

FIG. 4 shows a track ball;

FIG. 5 shows details of an example of embodiment of the detection means.

For the sake of simplicity in the continuation of the description, thesame objects will bear the same references in the different figures.

The device shown in FIG. 1, represents a switch 1, for example atwo-position switch. The switch comprises two terminals 3 and 4 one ofwhich, terminal 3 for example, is connected to ground. When the operatormaneuvers the mobile member 2, he connects or does not connect theterminal 4 to ground.

The device furthermore comprises detection means 5 providing informationrepresenting the existence or non-existence of a contact between theoperator and the mobile member 2. The mobile member 2 is, for example,metallic or comprises on its outer surface an electrically conductivematerial.

The mobile member 2 is electrically connected to an input 6 of thedetection means 5, for example by the intermediary of the body 7 of theswitch 1. The human body, on this occasion that of the operator, can beassimilated electrically as a resistance of the order of two kilohms.Thus, when a hand of the operator is in contact with the mobile member2, the input 6 is grounded through the intermediary of the equivalentresistance of the operator's human body. The detection means 5 comprisean output 8 upon which they supply information representing theexistence or non-existence of a contact between the operator and themobile member 2.

The device furthermore comprises validation means 9 represented by anAND gate. A first input 10 of the validation means 9 receives theinformation delivered by the detection means 5 on the output 8. A secondinput 11 of the validation means 9 receives data representing theposition of the mobile member 2. In FIG. 1, the second input 11 isconnected or not connected to ground by the intermediary of the terminal4, depending on the position of the mobile member 2. The validationmeans 9 deliver, on an output 12, the data present on the second input11 when the detection means 5 supply information representing theexistence of a contact between the operator and the mobile member 2.

In other words, the data supplied by the switch 1 is validated only whenthe operator touches the mobile member 2. This makes it possible toprevent an erroneous modification of the data, without an action by theoperator, from being taken into account by an item of equipmentreceiving the data present on the output 12. An erroneous modificationcan be, for example, due to a vibration undergone by the switch 1.

The invention also provides a difference in nature between the way inwhich data is input, in this case it is a matter of a mechanicalmovement of the mobile member 2, and the way in which the data isvalidated, in this case it is a matter of detecting the presence of theoperator. This difference in nature improves the safety of the datainput device. In fact, when the input of data and its validation areprovided by means of the same nature, for example mechanical, a singledisturbance, for example a vibration, can affect both the input of dataand the validation of that data. The invention therefore makes itpossible to avoid this problem.

Advantageously, as long as the detection means 5 have not detected thepresence of an operator, the validation means 9 maintain, on theiroutput 12, the data present on the input 11 at the time of the lastdetection of presence of the operator by the detection means 5. Thisfunction can be provided by the validation means 9.

FIG. 2 shows a variant embodiment of a device according to theinvention. The mobile member in this case comprises a rotary knob 20capable of rotating about an axis 21. The rotary knob 20 drives anoptical coder 22 by the intermediary of a shaft 23 which extends alongthe axis 21. A contact plate 24 is mounted integral with the shaft 23,substantially perpendicular to the axis 21. The contact plate 24 rotateswith the rotary knob 20. The outer surface of the rotary knob 20 iselectrically conductive and is electrically connected to the contactplate 24. A finger 25 forms the input 6 of the detection means 5. Thefinger 25 is electrically conductive and is in permanent contact withthe contact plate 24. Thus, whatever the angular position of the rotaryknob 21 about the axis 20 may be, when an operator touches the rotaryknob, the detection means 5 can deliver a signal corresponding to apossible contact between the operator and the rotary knob 21.Furthermore, the optical coder 22 delivers a signal representing theangular position of the rotary knob 20 about the axis 21 to the input 11of the validation means 9.

FIG. 3 shows another variant of a device according to the invention. Themobile member in this case comprises a push button 30 that the operatorcan press in, in a direction symbolized by the arrow 31. When the pushbutton 30 is pressed in, it electrically connects two contacts 32 and33. A coil spring 34 keeps the push button 30 in the high position byopposing its pressing in, in the direction 31. The outer surface of thepush button 30 is electrically conductive and is electrically connectedto the spring 34, which is also electrically conductive.

The spring 34 bears on the one hand on the push button 30 and, on theother hand, on a fixed part 35. The contacts 32 and 33 are integral withthe fixed part 35. The input 6 of the detection means is electricallyconnected to the end of the spring 34 bearing against the fixed part 35.The input 11 of the validation means 9 is electrically connected to thecontact 33. As regards the contact 32, this is connected to ground. Inthis variant, the connections of the inputs 6 and 11 are made onimmobile parts even when the operator maneuvers the push button 30.

In the variant shown in FIG. 4, the mobile member comprises a track ball40 capable of rotating about its center 41. The track ball 40 isintended to be maneuvered by the hand of an operator, for example inorder to move a cursor on a computer screen. The track ball 40 is guidedin its rotational movements by a casing 42. The movements of the trackball 40 are converted into electrical data by means of a follower 43.This electrical data is supplied to the input 11 of the validation means9. The outer surface of the track ball 40 is electrically conductive. Astrip 44, integral with the casing 42, is in permanent contact with theouter surface of the track ball 40 such that the operator's hand is inelectrical contact with the input 6 of the detection means 5 when he istouching the track ball 40.

FIG. 5 shows again the various components shown in FIG. 1 and givesdetails of an example embodiment of the detection means 5. It is ofcourse possible to replace the switch 1, shown in FIG. 5, in particularby one of the other data input devices shown in FIGS. 2 to 4.

The detection means 5, shown in FIG. 5, comprise a clock 50 delivering aclock signal to the input 6. The detection means 5 also comprise a firstlow pass filter 51, a demodulator 52 and a second low pass filter 53.When an operator is in contact with the mobile member 2, the input 6 isgrounded by the intermediary of the operator and the clock signal isvery highly attenuated. The input 6 also forms the input of the firstlow pass filter 51. The function of this filter 51 is to eliminatepossible high frequency interference signals which could be superimposedon the signal present on the input 6, the mobile member 2 being capableof acting as an antenna picking up such interference signals. The cutoff frequency of the filter 51 is, for example, of the order of a fewtens of megahertz and is, in any case, higher than the frequency of theclock signal. An output 54 of the filter 51 also represents the input ofthe demodulator 52 whose function is to deliver on its output 55 anenvelope signal of the signal present on the input 6. More precisely,when the clock signal is not attenuated, the signal present on theoutput 55 is at a high logic level. Conversely, when the clock signal isattenuated by a contact between the operator and the mobile member 2,the clock signal is at a low logic level. The output 55 forms the inputof the second low pass filter 53. The function of this filter 53 is toprevent changes of state of short duration of the output signal of thedetection means 5 from being taken into account. For example, thedetection means must not take into account a simple rapid brushing ofthe mobile member 2 by the operator. The cut off frequency of the secondlow pass filter 52 is, for example, of the order of a few tens of hertz.

The output of the low pass filter 53 forms the output 8 of the detectionmeans 5 which is connected to the input 10 of the validation means 9.The validation means 9 comprise, for example, an adder adding thesignals present on the two inputs 10 and 11.

1. A device for inputting data to an item of equipment comprising: a mobile member intended to be moved by an operator, the input data being dependent on the movement of the mobile member, detection means providing information representing the existence or non-existence of a contact between the operator and the mobile member, the contact with the operator being the normal contact the operator makes in order to move the mobile member, and validation means receiving the said information and the said input data, and in that the validation means supply the said input data to the equipment only when the information represents the existence of a contact between the operator and the mobile member; wherein the detection means detects ground signal continuity between the mobile member and the operator; and wherein the detection means comprises means for eliminating high frequency interference signals superimposed on a signal present on an input of the detection means.
 2. The device as claimed in claim 1, wherein the validation means comprises means of delivering the data existing at the time of the last detection of presence of the operator.
 3. The device as claimed in claim 1, wherein an input of the detection means is electrically connected to an electrically conductive surface of the mobile member.
 4. The device as claimed in claim 3, wherein the mobile member comprises a rotary knob and a contact plate integral with the rotary knob, the device comprising a finger forming an input of the detection means and in that the finger is in permanent contact with the contact plate.
 5. The device as claimed in claim 3, wherein the mobile member comprises a push button, in that a spring opposes a pushing in of the push button by the operator, and in that the spring electrically connects an outer surface of the push button to an input of the detection means.
 6. The device as claimed in claim 3, wherein the mobile member comprises a track ball of which an outer surface is electrically conductive, and in that it comprises means for keeping the outer surface of the track ball in contact with an input of the detection means.
 7. The device as claimed in claim 1, wherein the mobile member comprises a rotary knob and a contact plate integral with the rotary knob, the device comprising a finger forming an input of the detection means and in that the finger is in permanent contact with the contact plate.
 8. The device as claimed in claim 7, wherein an angular position of the rotary knob is transmitted to the validation means by an optical coder.
 9. The device as claimed in claim 1, wherein the mobile member comprises a push button, in that a spring opposes a pushing in of the push button by the operator, and in that the spring electrically connects an outer surface of the push button to an input of the detection means.
 10. The device as claimed in claim 9, wherein the detection means comprise a clock whose output signal is attenuated when the operator is in contact with the mobile member.
 11. The device as claimed in claim 9, wherein the mobile member comprises a track ball of which an outer surface is electrically conductive, and in that it comprises means for keeping the outer surface of the track ball in contact with an input of the detection means.
 12. The device as claimed in claim 1, wherein the mobile member comprises a track ball of which an outer surface is electrically conductive, and in that it comprises means for keeping the outer surface of the track ball in contact with an input of the detection means.
 13. The device as claimed in claim 1, wherein the detection means comprise a clock whose output signal is attenuated when the operator is in contact with the mobile member.
 14. The device as claimed in claim 13, wherein the detection means comprise means for delivering an envelope signal of the clock signal.
 15. The device as claimed in claim 13, wherein the detection means comprise means for preventing changes of state of short duration of an output signal of the detection means from being taken into account by the validation means.
 16. The device as claimed in claim 13, wherein the validation means comprise an adder adding an output signal of the detection means and data.
 17. The device as claimed in claim 1,wherein the detection means detects a predetermined resistance measured between the mobile member and a ground potential as provided by the operator being in contact with the mobile member.
 18. The device as claimed in claim 17, wherein the predetermined resistance is approximately 2 kilohms. 